Cloud Data Deduplication via Attribute-Based Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud computing faces inefficiencies in managing duplicated data storage, leading to resource waste, increased operational costs, and complex data management, while existing solutions fail to effectively deduplicate encrypted data and support flexible access control and digital rights management.
Innovation Solution
The proposed solution employs attribute-based encryption (ABE) to manage keys for duplicated data storage among authorized users, using hash codes for duplication detection and personalized secret keys for decryption, allowing data owners to control access and storage, and enabling deduplication without relying on third-party key servers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If duplicated data is stored in cloud computing, then data availability and access flexibility are improved, but storage resource waste and operational costs increase
Solution Approach 1:
The patent uses cryptographic copies (hash codes) of data to enable deduplication detection without storing actual data copies. When data is uploaded, a hash code is generated and stored; if the same hash code exists, the data is identified as a duplicate and not stored again. This allows the system to maintain data availability through reference to existing copies while avoiding redundant storage of actual data content.
2Quantity of substance
If data deduplication is implemented, then storage space is saved, but data security and access control become more complex
Solution Approach 1:
The patent introduces cryptographic hash codes as intermediaries between the actual data and the deduplication mechanism. Instead of directly comparing and managing large data files for deduplication, the system uses compact hash codes as proxies. These hash codes serve as unique identifiers that enable efficient duplicate detection while maintaining a clear link to the original data through cryptographic relationships, thereby simplifying the overall access control structure.
3Reliability
If encrypted data is stored with centralized key management, then data security is improved, but system reliability decreases due to single point of failure
Solution Approach 1:
The patent segments the centralized key management structure into distributed key components stored across multiple servers. Instead of relying on a single key server that could become a point of failure, the encryption keys are divided and stored across multiple nodes in the cloud infrastructure. This segmentation allows the system to maintain data security through cryptographic protection while improving reliability through distribution, eliminating the single point of failure.
4Loss of information
If data is encrypted before storage, then data privacy is protected, but deduplication capability is lost
Solution Approach 1:
The patent performs preliminary cryptographic hashing of data immediately upon upload, before the data is encrypted and stored. This preliminary action creates a unique fingerprint (hash code) of the original data that can be used for deduplication detection. The hash code is generated in advance, allowing the system to identify duplicates based on this pre-computed value even after the actual data is encrypted, thereby preserving deduplication capability while maintaining data privacy through encryption.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
An approach is provided for managing data duplication in cloud computing. A method comprising, sending from a first device to a data center, data encrypted with a data encryption key for storing the encrypted data at the data center; encrypting the data encryption key according to an attribute-based encryption (ABE) scheme by using identity as an attribute in a deduplication policy for the data; issuing to a second device, a personalized secret attribute key which is derived from a public key of the second device according to the attribute-based encryption (ABE) scheme, wherein the personalized secret attribute key is to be used for decrypting the encrypted data encryption key at the second device, in combination with the policy.